Permission evaluation is the concept of applying a set of rules to grant or deny access to resources, such as files, directories or other pieces of information on a computer. Virtual machine (VM), implemented according to a runtime standard, may request permissions to their security manager in order to access these various resources. A security manager installed on a client machine enables a custom security policy to be set for an application. For example, in an ECMA-335 (Common Language Infrastructure) VM, Code Access Security (CAS) is the security manager mechanism that limits the access an application code has to protected resources. CAS is implemented locally at each computer where the VM resides. CAS uses local policies with code evidence to define permission and permission sets that represent the application rights to access various system resources. At application runtime CAS compares requested permission with one or more security policies. Unauthorized actions are prevented from executing using these security checks. Other VM, like Java, use similar mechanisms, to evaluate application permissions.
In the past, three types of application permissions have been developed, that is, products with very basic access control, products with complex access control rules within an application, and products with no access control. Very basic access control (e.g., multiple permissions' flags encoded as bits and stored with a file entry) may bare little resemblance to an organization's requirements. As such, basic control may be suitable for a file system but not enough for a more complex environment such as a financial system. However, products with complex access control rules within applications are often difficult or even impossible to modify by the end-user of the application (e.g. enterprise hosting a web service). Finally, some products do not have any kind of access control.
Even applications providing access controls are often insufficient or incompatible with the user requirements, with the end result that they are often unused or even turned off. This situation has lead to the creation of new security standards and new security toolkits. These toolkits share properties that include, access control rules that are external to applications, rules resolution (e.g., decision making) that are internal to applications, rules that are human readable (e.g. ASCII, XML), rules that are mostly generated by tools, rules that can be complex (e.g. they can contain XPath expressions, regular expressions, scripts, etc.), and rules that can consume assertions made by other services. XACML (eXtensible Access Control Markup Language) is an example of such a language. SAML (Security Assertion Markup Language) is an example of a specification to consume/produce security assertions.
XACML is a standard for defining a general policy language used to protect resources as well as an access control decision language. Policy language allows administrators to define the access control requirements for their application resources.
SAML is an XML-based framework for Web services that enables the exchange of authentication and authorization information among business partners.
The addition of more complex security tools and decisions on a client machine, while useful, also have their drawbacks. In performing extensive security processes, the client system may result in overall performance slow down. Parsing and evaluating the required files and expressions within the client machine can be very time consuming, not to mention that many client machines of a network could be simultaneously taking the same action. In some cases the same files and expressions are evaluated many times for the same user and resource, a clearly inefficient situation.
As such, there is a need for evaluating complex security rules and decisions with less affect on client computer performance. There is a need to provide better overall performance for large-scale adaptation of access controls. The main disadvantage of the current implementation being that access control polices are inefficiently implemented for a large number of systems because maintenance and modifications to access control rules on each client machine becomes more difficult as more users and rules are added to the system.